@gvnrdao/dh-sdk 0.0.303 → 0.0.305

package/dist/index.mjs

@@ -444,9 +444,13 @@ var init_deployment_addresses = __esm({
           reason: "Validator gas fix (#420): BitcoinAddressValidator packed-table lookups; VERSION 1.0.0 -> 1.0.1"
         },
         UCDController: {
+          previousImplementation: "0x16f94AcC78cE87bEeBCfF90552091B3EfC071E48",
           newImplementation: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
-          upgradedBy: "Reconciled from chain \u2014 Upgraded event log unavailable; provenance omitted (never fabricated)",
-          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)"
+          upgradedAt: "2026-07-06T10:41:59.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xf6609d3fa43b460d953c85d8d7265b59bf177723042db79a6a700571bad777b7 (block 25472962)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xf6609d3fa43b460d953c85d8d7265b59bf177723042db79a6a700571bad777b7",
+          block: 25472962
         },
         PositionManagerCoreModule: {
           previousImplementation: "0x6C8b0FB93F8d0239254aefaC24d4264cA2F8AAeB",
@@ -1293,7 +1297,7 @@ var require_pkg_src = __commonJS({
         description: "Production Pkp Validator",
         version: "1.0.0",
         deployed: true,
-        deployedAt: 1783106284785,
+        deployedAt: 1784569687492,
         size: 4140,
         hash: "4c0d65bf1f33cdac22a78fd8c4764319cc3fe00650e0fe7fa8a6090d9a318a7b",
         validatorWalletAddress: "0x82db9f515957aa380b596c6ea2bd30cef181f236",
@@ -1370,17 +1374,17 @@ var require_pkg_src = __commonJS({
         }
       },
       btcWithdrawal: {
-        cid: "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2",
+        cid: "QmexvpfHPacjsVcqNHHLyJhSnnAPLgbWmWd9N3NDLDvYds",
         authorizedCidHex: cidToHex(
-          "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2"
+          "QmexvpfHPacjsVcqNHHLyJhSnnAPLgbWmWd9N3NDLDvYds"
         ),
         name: "Btc Withdrawal",
         description: "Production Btc Withdrawal",
-        version: "1.2.1",
+        version: "1.2.3",
         deployed: true,
-        deployedAt: 1784316549409,
-        size: 90692,
-        hash: "ca7276763142fe1fc812b70f6319973000faf338a91c531f898f8f6406035c64",
+        deployedAt: 1784585746901,
+        size: 92027,
+        hash: "7b4f4eab1f0c08b8b5b1c9cdb1064dd403ec13f57765919f62dec67fb8ba3c69",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -3752,12 +3756,23 @@ ${auth.clientId}`;
           if (!data.vout || !Array.isArray(data.vout)) {
             return null;
           }
-          return data.vout.map((output, index) => ({
-            index,
-            scriptpubkey: output.scriptpubkey,
-            scriptpubkey_address: output.scriptpubkey_address,
-            value: output.value ?? 0
-          }));
+          return data.vout.map((output, index) => {
+            if (output.value === void 0) {
+              throw new Error(
+                `getTransactionOutputs(${txid}): output ${index} is missing its value \u2014 malformed provider response, refusing to return outputs that cannot be value-verified`
+              );
+            }
+            assertSaneSatoshis(
+              output.value,
+              `getTransactionOutputs(${txid}) output ${index}`
+            );
+            return {
+              index,
+              scriptpubkey: output.scriptpubkey,
+              scriptpubkey_address: output.scriptpubkey_address,
+              value: output.value
+            };
+          });
         } catch (error) {
           clearTimeout(timeoutId);
           if (isAbortError(error)) {
@@ -6526,6 +6541,14 @@ var ServerSession = class {
   fetchImpl;
   cached = null;
   inFlight = null;
+  /**
+   * Bumped by `clearPersisted()` (logout / disconnect). An in-flight
+   * `getOrRefresh()` captures this at start and refuses to write its freshly
+   * minted token back to `this.cached`/the store if the value changed
+   * meanwhile — so a refresh racing a sign-out can't silently "un-clear" the
+   * credential it was told to drop.
+   */
+  generation = 0;
   /**
    * Store key for the current signer, memoized on first use so the sync
    * `clear()` can drop the persisted token without an async address lookup.
@@ -6541,8 +6564,22 @@ var ServerSession = class {
     this.now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
     this.fetchImpl = opts.fetchImpl ?? ((...a) => fetch(...a));
   }
-  /** Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds. */
-  async getValidToken() {
+  /**
+   * Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds.
+   * Pass `{ silent: true }` to forbid a fresh wallet signature: it resolves ONLY
+   * from a live cached token or the persisted re-mint envelope, never prompting
+   * and never joining a prompt-capable in-flight refresh (used by `logout()`,
+   * which must never pop the wallet during sign-out). Rejects when only a fresh
+   * signature could produce a token.
+   */
+  async getValidToken(opts) {
+    if (opts?.silent) {
+      const session2 = await this.tryResolveSilently(this.generation);
+      if (!session2) {
+        throw new Error("ServerSession: no existing session to refresh");
+      }
+      return session2.token;
+    }
     const session = await this.getOrRefresh();
     return session.token;
   }
@@ -6575,20 +6612,24 @@ var ServerSession = class {
    * from storage).
    */
   async clearPersisted() {
+    this.generation += 1;
     this.cached = null;
     this.inFlight = null;
     if (!this.store)
       return;
-    if (this.lastStoreKey) {
-      this.store.clear(this.lastStoreKey);
-      return;
-    }
     try {
-      const address = (await this.signer.getAddress()).toLowerCase();
-      this.store.clear(
-        sessionStoreKey(address, this.chainId, this.serviceEndpoint)
-      );
+      if (this.lastStoreKey) {
+        this.store.clear(this.lastStoreKey);
+      } else {
+        const address = (await this.signer.getAddress()).toLowerCase();
+        this.store.clear(
+          sessionStoreKey(address, this.chainId, this.serviceEndpoint)
+        );
+      }
     } catch {
+    } finally {
+      this.generation += 1;
+      this.cached = null;
     }
   }
   /**
@@ -6598,7 +6639,8 @@ var ServerSession = class {
    * of server response so the client stops presenting the token.
    */
   async logout() {
-    const token = this.cached?.token ?? await this.getValidToken().catch(() => null);
+    const cached = this.cached;
+    const token = cached && cached.expiresAt > this.now() ? cached.token : await this.getValidToken({ silent: true }).catch(() => null);
     await this.clearPersisted();
     if (!token)
       return;
@@ -6613,6 +6655,50 @@ var ServerSession = class {
       );
     }
   }
+  /**
+   * Resolve a session WITHOUT ever prompting for a wallet signature: a live
+   * cached token, else the persisted JWT (adopted if still fresh, otherwise
+   * silently re-minted from the envelope). Returns `null` only when a fresh
+   * wallet signature would be required (dead/absent envelope). Never touches
+   * `this.inFlight`, so a silent caller (logout) can resolve independently
+   * instead of being dragged into a prompt-capable refresh already in flight.
+   *
+   * `gen` is the caller's clear-generation snapshot: writes to `this.cached`
+   * and the store are skipped if a `clearPersisted()` landed meanwhile.
+   */
+  async tryResolveSilently(gen) {
+    const nowSec = this.now();
+    if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
+      return this.cached;
+    }
+    const persisted = await this.loadPersisted();
+    if (!persisted)
+      return null;
+    if (persisted.token && typeof persisted.tokenExpiresAt === "number" && persisted.tokenExpiresAt - REFRESH_LEEWAY_SECONDS > this.now()) {
+      const adopted = {
+        token: persisted.token,
+        expiresAt: persisted.tokenExpiresAt
+      };
+      if (gen === this.generation)
+        this.cached = adopted;
+      return adopted;
+    }
+    try {
+      const session = await this.login(persisted.payload);
+      if (gen === this.generation) {
+        this.persist(persisted.payload, session);
+        this.cached = session;
+      }
+      return session;
+    } catch (error) {
+      if (!isLoginRejection(error))
+        throw error;
+      if (gen === this.generation && this.store && this.lastStoreKey) {
+        this.store.clear(this.lastStoreKey);
+      }
+      return null;
+    }
+  }
   async getOrRefresh() {
     const nowSec = this.now();
     if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
@@ -6620,30 +6706,13 @@ var ServerSession = class {
     }
     if (this.inFlight)
       return this.inFlight;
+    const gen = this.generation;
+    const notCleared = () => gen === this.generation;
     this.inFlight = (async () => {
       try {
-        const persisted = await this.loadPersisted();
-        if (persisted) {
-          if (persisted.token && typeof persisted.tokenExpiresAt === "number" && persisted.tokenExpiresAt - REFRESH_LEEWAY_SECONDS > this.now()) {
-            this.cached = {
-              token: persisted.token,
-              expiresAt: persisted.tokenExpiresAt
-            };
-            return this.cached;
-          }
-          try {
-            const session2 = await this.login(persisted.payload);
-            this.persist(persisted.payload, session2);
-            this.cached = session2;
-            return session2;
-          } catch (error) {
-            if (!isLoginRejection(error))
-              throw error;
-            if (this.store && this.lastStoreKey) {
-              this.store.clear(this.lastStoreKey);
-            }
-          }
-        }
+        const existing = await this.tryResolveSilently(gen);
+        if (existing)
+          return existing;
         this.onSignaturePrompt?.();
         const payload = await buildSignedLoginPayload(
           this.signer,
@@ -6651,11 +6720,14 @@ var ServerSession = class {
           this.serviceEndpoint
         );
         const session = await this.login(payload);
-        this.persist(payload, session);
-        this.cached = session;
+        if (notCleared()) {
+          this.persist(payload, session);
+          this.cached = session;
+        }
         return session;
       } finally {
-        this.inFlight = null;
+        if (notCleared())
+          this.inFlight = null;
       }
     })();
     return this.inFlight;
@@ -16032,13 +16104,25 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
     return this.serverSession.getAuthHeader();
   }
   /**
-   * Remove the persisted lit-ops-server session (the 24h re-mint envelope and
-   * its JWT) for the current auth signer. Call on wallet disconnect or
-   * explicit sign-out so the credential does not outlive the wallet
-   * connection. No-op in standalone mode.
+   * Sign out of the lit-ops-server session for the current auth signer. Call on
+   * wallet disconnect or explicit sign-out so the credential does not outlive
+   * the wallet connection. No-op in standalone mode.
+   *
+   * Attempts a server-side revocation first (`ServerSession.logout()` — which
+   * tombstones the envelope's 24h re-mint window and invalidates the JWT), then
+   * always removes the local credential. If the revocation call fails (offline,
+   * server down, wallet already disconnected) we still clear locally so the
+   * session cannot silently re-mint after sign-out; `logout()` is best-effort
+   * and never prompts the wallet.
    */
   async clearServerSession() {
-    await this.serverSession?.clearPersisted();
+    if (!this.serverSession)
+      return;
+    try {
+      await this.serverSession.logout();
+    } catch {
+      await this.serverSession.clearPersisted();
+    }
   }
   /**
    * Audit H-9: invalidate the LoanQuery cache so subsequent reads return
@@ -20613,7 +20697,9 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
         gasUsed: receipt.gasUsed?.toString() || "unknown",
         utxoTxid: validationResponse.utxoTxid,
         utxoVout: validationResponse.utxoVout,
-        utxoSatoshis: validationResponse.utxoSatoshis
+        utxoSatoshis: validationResponse.utxoSatoshis,
+        // Phase B: full consensus-validated spend set (absent on older actions).
+        confirmedUtxos: validationResponse.confirmedUtxos
       };
     } catch (error) {
       const errorMsg = error instanceof Error ? error.message : String(error);
@@ -20643,6 +20729,42 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       };
     }
   }
+  /**
+   * TEMPORARY (multi-UTXO withdrawal fix, Phase A): fetch the vault's confirmed
+   * UTXO set from lit-ops-server (`GET /api/lit/vault-utxos`) so the caller can
+   * assemble and sign the FULL input set for a multi-UTXO consolidation
+   * withdrawal. Phase 1 only returns ONE representative UTXO, so a vault whose
+   * balance is spread across several UTXOs otherwise fails the Phase-2 signer
+   * with "Insufficient UTXO value ... across 1 input(s)".
+   *
+   * Returns `[]` on any failure (non-service mode, network error, bad shape) so
+   * callers transparently fall back to the single authorized UTXO. Superseded
+   * by the btc-withdrawal Lit Action returning its own confirmedUTXOs (Phase B).
+   */
+  async fetchConfirmedVaultUtxos(positionId) {
+    if (this.config.mode !== "service" || !this.config.serviceEndpoint)
+      return [];
+    try {
+      const pid = positionId.startsWith("0x") ? positionId : `0x${positionId}`;
+      const resp = await fetch(
+        `${this.config.serviceEndpoint}/api/lit/vault-utxos?positionId=${encodeURIComponent(pid)}`,
+        { method: "GET", headers: { ...await this.getAuthHeader() } }
+      );
+      if (!resp.ok)
+        return [];
+      const json = await resp.json();
+      if (!json.success || !Array.isArray(json.data?.utxos))
+        return [];
+      return json.data.utxos.map((u) => ({
+        txid: String(u.txid),
+        vout: Number(u.vout),
+        value: Number(u.value),
+        confirmations: Number(u.confirmations ?? 0)
+      }));
+    } catch {
+      return [];
+    }
+  }
   /**
    * Execute Bitcoin withdrawal (Phase 2)
    *
@@ -21259,13 +21381,49 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       if (this.config.debug) {
         log.info("\u{1F50D} Found vault UTXO for execution", { utxoIdentifier });
       }
+      let executionUtxos;
+      const gatheredUtxos = authResult.confirmedUtxos && authResult.confirmedUtxos.length > 0 ? authResult.confirmedUtxos.map((u) => ({
+        txid: u.txid,
+        vout: Number(u.vout),
+        value: Number(u.value),
+        confirmations: 0
+      })) : await this.fetchConfirmedVaultUtxos(positionId);
+      if (gatheredUtxos.length > 0) {
+        const normTxid = (t) => String(t).toLowerCase().replace(/^0x/, "");
+        const byOutpoint = /* @__PURE__ */ new Map();
+        for (const u of gatheredUtxos) {
+          const txid = normTxid(u.txid);
+          byOutpoint.set(`${txid}:${u.vout}`, {
+            txid,
+            vout: Number(u.vout),
+            value: Number(u.value)
+          });
+        }
+        const repKey = `${normTxid(authResult.utxoTxid)}:${authResult.utxoVout}`;
+        if (!byOutpoint.has(repKey)) {
+          byOutpoint.set(repKey, {
+            txid: normTxid(authResult.utxoTxid),
+            vout: Number(authResult.utxoVout),
+            value: Number(authResult.utxoSatoshis)
+          });
+        }
+        if (byOutpoint.size > 1) {
+          executionUtxos = Array.from(byOutpoint.values());
+          if (this.config.debug) {
+            log.info("\u{1F9E9} Multi-UTXO withdrawal: signing full input set", {
+              inputs: executionUtxos.length
+            });
+          }
+        }
+      }
       const executionResult = await this.executeBTCWithdrawal({
         positionId,
         utxoIdentifier,
         utxoSatoshis: Number(authResult.utxoSatoshis),
         networkFee,
         destination: withdrawalAddress,
-        targetAmount: withdrawalAmount
+        targetAmount: withdrawalAmount,
+        ...executionUtxos ? { utxos: executionUtxos } : {}
       });
       if (this.config.debug) {
         log.info("\u2705 Phase 2 complete: Bitcoin transaction executed", {

package/dist/interfaces/chunks/loan-operations.i.d.ts

@@ -233,6 +233,16 @@ export interface BTCWithdrawalResult {
     utxoVout?: number;
     /** Full satoshi value of the authorized UTXO; needed by Phase 2 broadcast. */
     utxoSatoshis?: string;
+    /**
+     * Phase B: the FULL consensus-validated confirmed UTXO set the Lit Action
+     * spends, so a multi-UTXO consolidation withdrawal can sign the whole set
+     * without the temporary /vault-utxos endpoint. Absent on older Lit Actions.
+     */
+    confirmedUtxos?: Array<{
+        txid: string;
+        vout: number;
+        value: string;
+    }>;
     error?: string;
 }
 /**

package/dist/modules/diamond-hands-sdk.d.ts

@@ -112,10 +112,16 @@ export declare class DiamondHandsSDK {
      */
     private getAuthHeader;
     /**
-     * Remove the persisted lit-ops-server session (the 24h re-mint envelope and
-     * its JWT) for the current auth signer. Call on wallet disconnect or
-     * explicit sign-out so the credential does not outlive the wallet
-     * connection. No-op in standalone mode.
+     * Sign out of the lit-ops-server session for the current auth signer. Call on
+     * wallet disconnect or explicit sign-out so the credential does not outlive
+     * the wallet connection. No-op in standalone mode.
+     *
+     * Attempts a server-side revocation first (`ServerSession.logout()` — which
+     * tombstones the envelope's 24h re-mint window and invalidates the JWT), then
+     * always removes the local credential. If the revocation call fails (offline,
+     * server down, wallet already disconnected) we still clear locally so the
+     * session cannot silently re-mint after sign-out; `logout()` is best-effort
+     * and never prompts the wallet.
      */
     clearServerSession(): Promise<void>;
     /**
@@ -442,6 +448,24 @@ export declare class DiamondHandsSDK {
      * @returns Withdrawal result with transaction details
      */
     withdrawBTC(positionId: string, withdrawalAddress: string, withdrawalAmount: number): Promise<BTCWithdrawalResult>;
+    /**
+     * TEMPORARY (multi-UTXO withdrawal fix, Phase A): fetch the vault's confirmed
+     * UTXO set from lit-ops-server (`GET /api/lit/vault-utxos`) so the caller can
+     * assemble and sign the FULL input set for a multi-UTXO consolidation
+     * withdrawal. Phase 1 only returns ONE representative UTXO, so a vault whose
+     * balance is spread across several UTXOs otherwise fails the Phase-2 signer
+     * with "Insufficient UTXO value ... across 1 input(s)".
+     *
+     * Returns `[]` on any failure (non-service mode, network error, bad shape) so
+     * callers transparently fall back to the single authorized UTXO. Superseded
+     * by the btc-withdrawal Lit Action returning its own confirmedUTXOs (Phase B).
+     */
+    fetchConfirmedVaultUtxos(positionId: string): Promise<Array<{
+        txid: string;
+        vout: number;
+        value: number;
+        confirmations: number;
+    }>>;
     /**
      * Execute Bitcoin withdrawal (Phase 2)
      *

package/dist/utils/server-session.d.ts

@@ -60,14 +60,31 @@ export declare class ServerSession {
     private readonly fetchImpl;
     private cached;
     private inFlight;
+    /**
+     * Bumped by `clearPersisted()` (logout / disconnect). An in-flight
+     * `getOrRefresh()` captures this at start and refuses to write its freshly
+     * minted token back to `this.cached`/the store if the value changed
+     * meanwhile — so a refresh racing a sign-out can't silently "un-clear" the
+     * credential it was told to drop.
+     */
+    private generation;
     /**
      * Store key for the current signer, memoized on first use so the sync
      * `clear()` can drop the persisted token without an async address lookup.
      */
     private lastStoreKey;
     constructor(opts: ServerSessionOptions);
-    /** Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds. */
-    getValidToken(): Promise<string>;
+    /**
+     * Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds.
+     * Pass `{ silent: true }` to forbid a fresh wallet signature: it resolves ONLY
+     * from a live cached token or the persisted re-mint envelope, never prompting
+     * and never joining a prompt-capable in-flight refresh (used by `logout()`,
+     * which must never pop the wallet during sign-out). Rejects when only a fresh
+     * signature could produce a token.
+     */
+    getValidToken(opts?: {
+        silent?: boolean;
+    }): Promise<string>;
     /** Convenience for fetch: spread directly into `headers`. */
     getAuthHeader(): Promise<Record<string, string>>;
     /**
@@ -89,6 +106,18 @@ export declare class ServerSession {
      * of server response so the client stops presenting the token.
      */
     logout(): Promise<void>;
+    /**
+     * Resolve a session WITHOUT ever prompting for a wallet signature: a live
+     * cached token, else the persisted JWT (adopted if still fresh, otherwise
+     * silently re-minted from the envelope). Returns `null` only when a fresh
+     * wallet signature would be required (dead/absent envelope). Never touches
+     * `this.inFlight`, so a silent caller (logout) can resolve independently
+     * instead of being dragged into a prompt-capable refresh already in flight.
+     *
+     * `gen` is the caller's clear-generation snapshot: writes to `this.cached`
+     * and the store are skipped if a `clearPersisted()` landed meanwhile.
+     */
+    private tryResolveSilently;
     private getOrRefresh;
     private login;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gvnrdao/dh-sdk",
-  "version": "0.0.303",
+  "version": "0.0.305",
   "description": "TypeScript SDK for Diamond Hands Protocol - Bitcoin-backed lending with LIT Protocol PKPs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -82,8 +82,8 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@gvnrdao/dh-lit-actions": "^0.0.314",
-    "@gvnrdao/dh-lit-ops": "^0.0.304",
+    "@gvnrdao/dh-lit-actions": "^0.0.315",
+    "@gvnrdao/dh-lit-ops": "^0.0.305",
     "@noble/hashes": "^1.5.0",
     "axios": "^1.17.0",
     "bech32": "^2.0.0",